--- title: ThirdPartyTrust Blog | Vendor Risk Management description: Vendor Risk Management | VRM, Vendor Risk Managerment, Vendor Intelligence --- ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, [![ThirdPartyTrust](https://info.thirdpartytrust.com/hubfs/Thirdpartytrust%20April2017/Thirdpartytrust%20April2017-images/3ptlogonav-1%20(1).png)](https://www.thirdpartytrust.com/) [![ThirdPartyTrust](https://info.thirdpartytrust.com/hubfs/Thirdpartytrust%20April2017/Thirdpartytrust%20April2017-images/smaller-1.png)](https://www.thirdpartytrust.com/) - [Product](https://www.thirdpartytrust.com/enterprise-solutions) - [Enterprise Solutions](https://www.thirdpartytrust.com/enterprise-solutions) - [Vendors Solutions](https://www.thirdpartytrust.com/vendor-solutions) - Industries - [Financial Services](http://www.thirdpartytrust.com/financial-services) - [Life Sciences](https://www.thirdpartytrust.com/lifesciences) - [Healthcare](https://www.thirdpartytrust.com/healthcare) - [Energy](https://www.thirdpartytrust.com/energy) - News & Events - [Blog](https://info.thirdpartytrust.com/blog) - [Press Releases](https://info.thirdpartytrust.com/pressreleases) - [ThirdPartyTrust Events](https://www.thirdpartytrust.com/thirdpartytrust-events) - Resources - [Who We Are](https://www.thirdpartytrust.com/about) - [Videos](https://www.thirdpartytrust.com/videos) - [Become a Partner](https://www.thirdpartytrust.com/become-a-partner) - [Current Partners](https://www.thirdpartytrust.com/partners) - [API](http://docs.thirdpartytrust.com/) - [Product Security](https://www.thirdpartytrust.com/security) - [Login](https://app.thirdpartytrust.com/) ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, # ThirdPartyTrust Blog ## [The key essentials when designing the process around third-party risk management](https://info.thirdpartytrust.com/blog/key-essential-designing-the-process-around-tprm) Posted by [Lily Hwang](https://info.thirdpartytrust.com/blog/author/lily-hwang) on 12/13/19 3:43 PM - [Tweet](https://twitter.com/share) [![computer+hands2sm](https://info.thirdpartytrust.com/hubfs/computer+hands2sm.png)](https://info.thirdpartytrust.com/blog/key-essential-designing-the-process-around-tprm) When you are deciding to create a framework for your third-party risk program you need to take the following into consideration: - How are you going to categorize your third-parties? - How would you rank your third-parties? - What is  the criteria/requirement for each one of those categories? Other areas to consider involve the people component of the workflow, such as business owners, legal, and procurement.  Especially during the contracting phase, by including legal language that assessments and/or assurance programs must be provided. Also, include stipulations regarding renewals that reassessments are required.  And of course, there is technology, the enabler. Technology provides the automation and a structured way to capture specific data for business and executives to make key decisions on these relationships. Monitoring these data points will contribute to the success or failure of that third-party.  [Read More](https://info.thirdpartytrust.com/blog/key-essential-designing-the-process-around-tprm) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/key-essential-designing-the-process-around-tprm#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management), [third party risk](https://info.thirdpartytrust.com/blog/topic/third-party-risk) ## [Data is the new oil and breaches are the new spills; so where is the leak?](https://info.thirdpartytrust.com/blog/data-is-the-new-oil-and-breaches-are-the-new-spills-so-where-is-the-leak) Posted by [Jeffrey Spetter](https://info.thirdpartytrust.com/blog/author/jeffrey-spetter) on 7/6/18 9:11 AM - [Tweet](https://twitter.com/share) [![0*XnuUkRvCz6y3k8PN](https://cdn-images-1.medium.com/max/752/0*XnuUkRvCz6y3k8PN.jpg)](https://info.thirdpartytrust.com/blog/data-is-the-new-oil-and-breaches-are-the-new-spills-so-where-is-the-leak) The former CEO of Intel, Brian Kzranich said last month, “Data, I look at it as the new oil. It’s going to change most industries across the board. Oil changed the world in the 1900s. It drove cars, it drove the whole chemical industry,” Krzanich explains. [Read More](https://info.thirdpartytrust.com/blog/data-is-the-new-oil-and-breaches-are-the-new-spills-so-where-is-the-leak) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/data-is-the-new-oil-and-breaches-are-the-new-spills-so-where-is-the-leak#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management) ## [The Real Challenges of Moving Cyber Initiatives Forward](https://info.thirdpartytrust.com/blog/whats-going-to-be-hard-about-moving-cyber-initiatives) Posted by [Jeffrey Spetter](https://info.thirdpartytrust.com/blog/author/jeffrey-spetter) on 5/29/18 9:45 AM - [Tweet](https://twitter.com/share) [![Jim Hagemann Snabe](https://www.bleepstatic.com/content/posts/2018/01/25/Jim_Hagemann_Snabe.jpg)](https://info.thirdpartytrust.com/blog/whats-going-to-be-hard-about-moving-cyber-initiatives) With growing executive demand for changes to cybersecurity processes and awareness comes inherent challenges to an organization. To set the stage, the NotPetya attacks on Moeller-Maersk shipping company took them offline for ten days. Jim Haggemann Snabe, the Chairman, describes the heroic efforts to get 45,000 PCs and 2,500 servers back and up and running ([see video](https://www.bleepingcomputer.com/news/security/maersk-reinstalled-45-000-pcs-and-4-000-servers-to-recover-from-notpetya-attack/)) proves that ransomware attacks or never before seen attacks can have tremendous impact on business operations. [Read More](https://info.thirdpartytrust.com/blog/whats-going-to-be-hard-about-moving-cyber-initiatives) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/whats-going-to-be-hard-about-moving-cyber-initiatives#comments-listing) Topics: [Regulation](https://info.thirdpartytrust.com/blog/topic/regulation), [IoT Security](https://info.thirdpartytrust.com/blog/topic/iot-security), [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management), [third party risk](https://info.thirdpartytrust.com/blog/topic/third-party-risk) ## [TPT InfoSec Interviews: Rocio Baeza, CEO Cybersecuritybase](https://info.thirdpartytrust.com/blog/tptinterviewrociobaeza) Posted by [Jeffrey Spetter](https://info.thirdpartytrust.com/blog/author/jeffrey-spetter) on 3/27/18 12:39 PM - [Tweet](https://twitter.com/share) [![Untitled.png](https://info.thirdpartytrust.com/hubfs/Untitled.png)](https://info.thirdpartytrust.com/blog/tptinterviewrociobaeza) Hi, everyone. This is Jeff Spetter from ThirdPartyTrust and I had the great pleasure of speaking with Rocio Baeza, CEO of CyberSecurityBase. Here's a recap and audio of the interview.  [Read More](https://info.thirdpartytrust.com/blog/tptinterviewrociobaeza) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/tptinterviewrociobaeza#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management) ## [Emerging Technology, Unknown Risks: DePaul University's Fourth Annual Cyber Risk Conference | Part Two](https://info.thirdpartytrust.com/blog/emerging-technology-unknown-risks-depaul-universitys-fourth-annual-cyber-risk-conference-part-two) Posted by [Yasmeen Ghazal](https://info.thirdpartytrust.com/blog/author/yasmeen-ghazal) on 12/20/17 9:10 AM - [Tweet](https://twitter.com/share) [![](https://img.evbuc.com/https%3A%2F%2Fcdn.evbuc.com%2Fimages%2F37728894%2F108187986545%2F1%2Foriginal.jpg?w=1000&rect=0%2C37%2C1132%2C566&s=6f71d509dc44b02d94ab043b262076a9)](https://info.thirdpartytrust.com/blog/emerging-technology-unknown-risks-depaul-universitys-fourth-annual-cyber-risk-conference-part-two) [Part one](https://info.thirdpartytrust.com/blog/emerging-technology-unknown-risks-depaul-universitys-fourth-annual-cyber-risk-conference-part-one)[ of the DePaul Cyber Risk Panel](https://info.thirdpartytrust.com/blog/emerging-technology-unknown-risks-depaul-universitys-fourth-annual-cyber-risk-conference-part-one) covered:  - How to start building a vendor risk management program - Key vendor risk management metrics  - How to keep the vendor engaged after the contract has been signed In Part 2, panelists answer audience questions. Including what constitutes a vendor and varying risk profiles for vendors.  [Read More](https://info.thirdpartytrust.com/blog/emerging-technology-unknown-risks-depaul-universitys-fourth-annual-cyber-risk-conference-part-two) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/emerging-technology-unknown-risks-depaul-universitys-fourth-annual-cyber-risk-conference-part-two#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management), [Panel Discussions](https://info.thirdpartytrust.com/blog/topic/panel-discussions) ## [2017 Vendor Risk Management BenchMark Study | Protiviti & Shared Assessments](https://info.thirdpartytrust.com/blog/2017-vendor-risk-management-benchmark-study-protiviti-shared-assessments) Posted by [Yasmeen Ghazal](https://info.thirdpartytrust.com/blog/author/yasmeen-ghazal) on 11/21/17 4:40 PM - [Tweet](https://twitter.com/share) [![](https://mma.prnewswire.com/media/478102/SFG_SA_color_logo_tag_022217_Logo.jpg?p=facebook)](https://info.thirdpartytrust.com/blog/2017-vendor-risk-management-benchmark-study-protiviti-shared-assessments) The external risk environment is changing quickly as massive and costly cyber attacks -- Home Depot, Boston Medical Center and the Department of Veterans Affairs, among others -- have struck in the past couple years, continuing to challenge organizations to re-think approaches to vendor risk management. [Read More](https://info.thirdpartytrust.com/blog/2017-vendor-risk-management-benchmark-study-protiviti-shared-assessments) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/2017-vendor-risk-management-benchmark-study-protiviti-shared-assessments#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management) ## [Keynote Panel: Re-thinking How to Build Trust in the Vendor Eco-System](https://info.thirdpartytrust.com/blog/keynote-panel-rethinking-how-to-build-trust-in-the-vendor-eco-system) Posted by [Yasmeen Ghazal](https://info.thirdpartytrust.com/blog/author/yasmeen-ghazal) on 10/30/17 9:00 AM - [Tweet](https://twitter.com/share) [![](https://info.thirdpartytrust.com/hubfs/IMG_6391.jpg)](https://info.thirdpartytrust.com/blog/keynote-panel-rethinking-how-to-build-trust-in-the-vendor-eco-system)   On October 18th, 2017, McCormick Center held 3,000 attendees as the first annaul Cyber Security Chicago conference. It offered invaluable insights around hot topics in the industry including [IoT Security](https://info.thirdpartytrust.com/blog/who-will-be-in-charge-of-iot-security), DevSecOps and the Equifax Breach. On the Keynote Stage, [Anders Norremo](https://www.linkedin.com/in/andersnorremo/), CEO of ThirdPartyTrust, led a keynote on Re-Thinking How to Build Trust in the Vendor Eco-System alongside   [Fawaz Rasheed](https://www.linkedin.com/in/fawaz-rasheed-cissp-515b67/) , CISO  of [Trustmark Companies](http://www.trustmarkcompanies.com/), and  [Matt Dechant](https://www.linkedin.com/in/matthew-dechant-50b5174/) , CISO of [Tempus](https://www.tempus.com/).  [Read More](https://info.thirdpartytrust.com/blog/keynote-panel-rethinking-how-to-build-trust-in-the-vendor-eco-system) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/keynote-panel-rethinking-how-to-build-trust-in-the-vendor-eco-system#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management), [third party risk](https://info.thirdpartytrust.com/blog/topic/third-party-risk) ## [Data Risk in the Third-Party | Ponemon Institute](https://info.thirdpartytrust.com/blog/ponemoninstitutepart1) Posted by [Jeffrey Spetter](https://info.thirdpartytrust.com/blog/author/jeffrey-spetter) on 10/12/17 8:29 AM - [Tweet](https://twitter.com/share) [![](https://d2vo5wp34bl1tg.cloudfront.net/uploads/2017/09/bg-opus-6-trends-third-party-data-risk-study.jpg)](https://info.thirdpartytrust.com/blog/ponemoninstitutepart1) The Ponemon Institute recently rolled out there second annual study of [Data Risk in the Third-Party Ecosystem](https://info.thirdpartytrust.com/hubfs/Ponemon_report_Final%20(1).pdf). The study aims to understand trends in the challenges companies face in protecting sensitive and confidential information shared with third parties and 4th party vendors.  [Read More](https://info.thirdpartytrust.com/blog/ponemoninstitutepart1) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/ponemoninstitutepart1#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management), [third party risk](https://info.thirdpartytrust.com/blog/topic/third-party-risk) ## [Panel: Cybersecurity & Manufacturing in the digital era](https://info.thirdpartytrust.com/blog/panel-cybersecurity-manufacturing-in-the-digital-era) Posted by [Yasmeen Ghazal](https://info.thirdpartytrust.com/blog/author/yasmeen-ghazal) on 9/11/17 4:20 PM - [Tweet](https://twitter.com/share) [![](https://info.thirdpartytrust.com/hubfs/IMG_5434.jpg)](https://info.thirdpartytrust.com/blog/panel-cybersecurity-manufacturing-in-the-digital-era) On September 6th, 2017, [Anders Norremo](https://www.linkedin.com/in/andersnorremo/), CEO of ThirdPartyTrust, moderated a panel of manufacturing experts on the topic of CyberSecurity & Manufacturing in the Digital Era at the OnRamp Conference in Milwaukee, WI. Panelists included [Chris Merkel](https://www.linkedin.com/in/cmerkel/), CISO of Brunswick Corp; [David McPhee](https://www.linkedin.com/in/david-mcphee-9412608/), the Regional Information Security Manager at Caterpillar; [Michael Goetzman](https://www.linkedin.com/in/goetzman/), CISO at Master Lock; and [Steve Brukbacher](https://www.linkedin.com/in/steve-brukbacher-cissp-ccsp-gsna-618b01/), the Application Security Manager at Johnson Controls.  [Read More](https://info.thirdpartytrust.com/blog/panel-cybersecurity-manufacturing-in-the-digital-era) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/panel-cybersecurity-manufacturing-in-the-digital-era#comments-listing) Topics: [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management) ## [7 Risks to Data In the Third Party Eco-system](https://info.thirdpartytrust.com/blog/7-risks-to-data-in-the-third-party-eco-system) Posted by [Jeffrey Spetter](https://info.thirdpartytrust.com/blog/author/jeffrey-spetter) on 8/21/17 8:30 AM - [Tweet](https://twitter.com/share) [![](http://en.fasoo.com/_data/ckfinder/images/en/ponemon-logo.png)](https://info.thirdpartytrust.com/blog/7-risks-to-data-in-the-third-party-eco-system) The Ponemon Institute conducted a study back in April of 2016 surveying companies to understand the challenges they face in protecting sensitive and confidential information shared with third parties resulting in [*Data Risk in the Third-Party Ecosystem*](https://www.ponemon.org/local/upload/file/Data%20Risk%20in%20the%20Third%20Party%20Ecosystem_BuckleySandler%20LLP%20and%20Treliant%20Risk%20Advisors%20LLC%20Ponemon%20Research%202016%20-%20FINAL2.pdf) study. [Read More](https://info.thirdpartytrust.com/blog/7-risks-to-data-in-the-third-party-eco-system) 0 Comments [Click here to read/write comments](https://info.thirdpartytrust.com/blog/7-risks-to-data-in-the-third-party-eco-system#comments-listing) Topics: [Regulation](https://info.thirdpartytrust.com/blog/topic/regulation), [Vendor Risk Management](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management), [Best Practices](https://info.thirdpartytrust.com/blog/topic/best-practices) [All posts](https://info.thirdpartytrust.com/blog/all) [Next](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management/page/2) ThirdPartyTrust is a vendor risk management platform strengthening cyber risk intelligence and simplifying the management process for enterprises performing vendor risk assessments.   By analyzing both third and fourth party vendor cyber risk using a network-based solution, like 3PT, trust is built and mapped within your vendor eco-system. ### Subscribe to Email Updates ### Recent Posts ### Posts by Topic - [Vendor Risk Management (13)](https://info.thirdpartytrust.com/blog/topic/vendor-risk-management) - [third party risk (7)](https://info.thirdpartytrust.com/blog/topic/third-party-risk) - [Regulation (6)](https://info.thirdpartytrust.com/blog/topic/regulation) - [Data Breaches (3)](https://info.thirdpartytrust.com/blog/topic/data-breaches) - [Panel Discussions (3)](https://info.thirdpartytrust.com/blog/topic/panel-discussions) - [Partnerships (3)](https://info.thirdpartytrust.com/blog/topic/partnerships) - [Best Practices (2)](https://info.thirdpartytrust.com/blog/topic/best-practices) - [Cyber Tools (2)](https://info.thirdpartytrust.com/blog/topic/cyber-tools) - [GDPR (2)](https://info.thirdpartytrust.com/blog/topic/gdpr) - [IoT Security (2)](https://info.thirdpartytrust.com/blog/topic/iot-security) see all [![facebook](https://info.thirdpartytrust.com/hubfs/Thirdpartytrust%20April2017/Thirdpartytrust%20April2017-images/f1.png)](https://www.facebook.com/thirdpartytrust) [![twitter](https://info.thirdpartytrust.com/hubfs/Thirdpartytrust%20April2017/Thirdpartytrust%20April2017-images/13.png)](https://twitter.com/thirdpartytrust) [![linkedin](https://info.thirdpartytrust.com/hubfs/Thirdpartytrust%20April2017/Thirdpartytrust%20April2017-images/11.png)](https://www.linkedin.com/company/thirdpartytrust) [sign up for our newsletter](https://www.thirdpartytrust.com/sign-up-for-newsletter)